Updated 20 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

38added in the last 30 days

561new WordPress flaws this week

398,769entries in the database

24,693 results · page 375 of 494

Jun 15, 2024WooCommerce - Social Login: Email VerificationCVE-2024-5868 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.
Product
WooCommerce - Social Login
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jun 14, 2024tagDiv Composer: Local File InclusionCVE-2024-3813 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'block_template_id' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
tagDiv Composer
Affected
up to 4.8
What to do
Affects up to 4.8. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
Jun 14, 2024Popup Builder: Unauthorized modification of data and loss of dataCVE-2024-2544 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions, such as deleting subscribers, and importing subscribers to conduct stored cross-site scripting attacks.
Product
Popup Builder
Fixed in
4.3.2
What to do
Update Popup Builder to 4.3.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2024Popup Builder – Create highly converting, mobile friendly marketing popups.: Unauthorized access of functionalityCVE-2023-6696 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. While some functions contain a nonce check, the nonce can be obtained from the profile page of a logged-in user. This allows subscribers to perform several actions including deleting subscribers and perform blind Server-Side Request Forgery.
Product
Popup Builder – Create highly converting, mobile friendly marketing popups.
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update Popup Builder – Create highly converting, mobile friendly marketing popups. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2024ProjectHuddle Client Site: Missing AuthorizationCVE-2023-51376 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force ProjectHuddle Client Site.This issue affects ProjectHuddle Client Site: from n/a through 1.0.34.
Product
ProjectHuddle Client Site
Affected
up to 1.0.34
What to do
Affects up to 1.0.34. Update ProjectHuddle Client Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024LatePoint: Unauthorized access of data and modification of dataCVE-2024-2472 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.
Product
LatePoint
Affected
up to 4.9.9
What to do
Affects up to 4.9.9. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record aramhairchitects.nl websec.nl
Jun 14, 2024Where I Was, Where I Will Be: Remote File Inclusion in version <= 1CVE-2024-5577 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version <= 1.1.1 via the WIW_HEADER parameter of the /system/include/include_user.php file. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external servers, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution. This requires allow_url_include to be set to true in order to exploit, which is not commonly enabled.
Product
Where I Was, Where I Will Be
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Where I Was, Where I Will Be to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2024Ninja Tables: Missing AuthorizationCVE-2024-23504 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5.
Product
Ninja Tables
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024WooCommerce Ship to Multiple Addresses: Missing AuthorizationCVE-2023-51497 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.9.
Product
WooCommerce Ship to Multiple Addresses
Affected
up to 3.8.9
What to do
Affects up to 3.8.9. Update WooCommerce Ship to Multiple Addresses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024WooCommerce Warranty Requests: Missing AuthorizationCVE-2023-51496 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
Product
WooCommerce Warranty Requests
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update WooCommerce Warranty Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024WooCommerce Warranty Requests: Missing AuthorizationCVE-2023-51495 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
Product
WooCommerce Warranty Requests
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update WooCommerce Warranty Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024Everest Forms: Missing AuthorizationCVE-2023-51377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPEverest Everest Forms.This issue affects Everest Forms: from n/a through 2.0.3.
Product
Everest Forms
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024Canto: Remote File InclusionCVE-2024-4936 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allow_url_include to be enabled on the target site in order to exploit.
Product
Canto
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Canto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2024Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling: Unauthorized modification of dataCVE-2024-1094 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant users staff permissions. CVE-2024-37427 is likely a duplicate of this issue.
Product
Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Affected
up to 1.0.21
What to do
Affects up to 1.0.21. Update Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 13, 2024WooCommerce Easy Duplicate Product: Missing AuthorizationCVE-2023-51523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WriterSystem WooCommerce Easy Duplicate Product.This issue affects WooCommerce Easy Duplicate Product: from n/a through 0.3.0.7.
Product
WooCommerce Easy Duplicate Product
Affected
up to 0.3.0.7
What to do
Affects up to 0.3.0.7. Update WooCommerce Easy Duplicate Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Business Directory: Missing AuthorizationCVE-2023-51516 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Business Directory Team Business Directory Plugin.This issue affects Business Directory Plugin: from n/a through 6.3.9.
Product
Business Directory
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Quiz And Survey Master: Missing AuthorizationCVE-2023-51507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16.
Product
Quiz And Survey Master
Affected
up to 8.1.16
What to do
Affects up to 8.1.16. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024WP Dummy Content Generator: Missing AuthorizationCVE-2023-37394 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 2.3.0.
Product
WP Dummy Content Generator
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Sublanguage: Missing AuthorizationCVE-2023-36695 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Maxime Schoeni Sublanguage.This issue affects Sublanguage: from n/a through 2.9.
Product
Sublanguage
Affected
up to 2.9
What to do
Affects up to 2.9. Update Sublanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Kingkong Board: Missing AuthorizationCVE-2023-36694 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Bryan Lee Kingkong Board.This issue affects Kingkong Board: from n/a through 2.1.0.2.
Product
Kingkong Board
Affected
up to 2.1.0.2
What to do
Affects up to 2.1.0.2. Update Kingkong Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024BBS e-Popup: Missing AuthorizationCVE-2023-36504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BBS e-Theme BBS e-Popup.This issue affects BBS e-Popup: from n/a through 2.4.5.
Product
BBS e-Popup
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update BBS e-Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Fat Rat Collect: Missing AuthorizationCVE-2023-35045 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fat Rat Fat Rat Collect.This issue affects Fat Rat Collect: from n/a through 2.6.7.
Product
Fat Rat Collect
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update Fat Rat Collect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024SendPress Newsletters: Missing AuthorizationCVE-2023-35040 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SendPress SendPress Newsletters.This issue affects SendPress Newsletters: from n/a through 1.23.11.6.
Product
SendPress Newsletters
Affected
up to 1.23.11.6
What to do
Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024SKU Label Changer For WooCommerce: Missing AuthorizationCVE-2023-29174 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NervyThemes SKU Label Changer For WooCommerce.This issue affects SKU Label Changer For WooCommerce: from n/a through 3.0.
Product
SKU Label Changer For WooCommerce
Affected
up to 3.0
What to do
Affects up to 3.0. Update SKU Label Changer For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More: PHP Object InjectionCVE-2024-4371 · WordPress plugins & themes · reported by WordfenceCritical 9
The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.1 via deserialization of untrusted input from the recently_viewed_products cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 13, 2024Easy WP SMTP by SendLayer – WordPress SMTP and Email Log: Information exposureCVE-2024-3073 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administrator account becomes compromised this could be useful information to an attacker in a limited environment.
Product
Easy WP SMTP by SendLayer – WordPress SMTP and Email Log
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Easy WP SMTP by SendLayer – WordPress SMTP and Email Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 13, 2024PowerPack Addons for Elementor (Free Widgets, Extensions and Templates): Stored Cross-Site ScriptingCVE-2024-5787 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's Link Effects widget in all versions up to, and including, 2.7.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
Affected
up to 2.7.20
What to do
Affects up to 2.7.20. Update PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2024Web Directory Free: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-3552 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
Product
Web Directory Free
Fixed in
1.7.0
What to do
Update Web Directory Free to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 12, 2024Dokan Pro: SQL InjectionCVE-2024-3922 · WordPress plugins & themes · reported by WordfenceCritical 10
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Dokan Pro
Affected
up to 3.10.3
What to do
Affects up to 3.10.3. Update Dokan Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record dokan.co wordfence.com
Jun 12, 2024InstaWP Connect – 1-click WP Staging & Migration: Arbitrary option updatesCVE-2024-4898 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.0.38
What to do
Affects up to 0.1.0.38. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2024Icegram Express: SQL InjectionCVE-2024-4845 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’ parameter in all versions up to, and including, 5.7.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Icegram Express
Affected
up to 5.7.22
What to do
Affects up to 5.7.22. Update Icegram Express to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2024weForms: Missing AuthorizationCVE-2023-51524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.18.
Product
weForms
Affected
up to 1.6.18
What to do
Affects up to 1.6.18. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Piotnet Forms: Missing AuthorizationCVE-2023-51413 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.29.
Product
Piotnet Forms
Affected
up to 1.0.29
What to do
Affects up to 1.0.29. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Consensu.Io: Missing AuthorizationCVE-2023-48280 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Consensu.IO Consensu.Io.This issue affects Consensu.Io: from n/a through 1.0.1.
Product
Consensu.Io
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Consensu.Io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024wpMandrill: Missing AuthorizationCVE-2023-47828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mandrill wpMandrill.This issue affects wpMandrill: from n/a through 1.33.
Product
wpMandrill
Affected
up to 1.33
What to do
Affects up to 1.33. Update wpMandrill to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024WP GPX Map: Missing AuthorizationCVE-2023-44234 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bastianon Massimo WP GPX Map.This issue affects WP GPX Map: from n/a through 1.7.08.
Product
WP GPX Map
Affected
up to 1.7.08
What to do
Affects up to 1.7.08. Update WP GPX Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Pricing Deals for WooCommerce: Missing AuthorizationCVE-2023-41240 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vark Pricing Deals for WooCommerce.This issue affects Pricing Deals for WooCommerce: from n/a through 2.0.3.2.
Product
Pricing Deals for WooCommerce
Affected
up to 2.0.3.2
What to do
Affects up to 2.0.3.2. Update Pricing Deals for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Sticky Social Media Icons: Missing AuthorizationCVE-2023-40672 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Hardik Chavada Sticky Social Media Icons.This issue affects Sticky Social Media Icons: from n/a through 2.1.
Product
Sticky Social Media Icons
Affected
up to 2.1
What to do
Affects up to 2.1. Update Sticky Social Media Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Simple Org Chart: Missing AuthorizationCVE-2023-40603 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gangesh Matta Simple Org Chart.This issue affects Simple Org Chart: from n/a through 2.3.4.
Product
Simple Org Chart
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Simple Org Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Highcompress Image Compressor: Missing AuthorizationCVE-2023-40209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Himalaya Saxena Highcompress Image Compressor.This issue affects Highcompress Image Compressor: from n/a through 6.0.0.
Product
Highcompress Image Compressor
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update Highcompress Image Compressor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024WP Clone Menu: Missing AuthorizationCVE-2023-38395 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Afzal Multani WP Clone Menu.This issue affects WP Clone Menu: from n/a through 1.0.1.
Product
WP Clone Menu
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Clone Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Buy Me a Coffee: Missing AuthorizationCVE-2023-25030 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Buy Me a Coffee.This issue affects Buy Me a Coffee: from n/a through 3.7.
Product
Buy Me a Coffee
Affected
up to 3.7
What to do
Affects up to 3.7. Update Buy Me a Coffee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024WordPress Header Builder Plugin – Pearl: Unauthorized site option deletionCVE-2024-5468 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stm_hb_delete() function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to delete arbitrary options that can be used to perform a denial of service attack on a site.
Product
WordPress Header Builder Plugin – Pearl
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update WordPress Header Builder Plugin – Pearl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2024Integrate Google Drive: Missing AuthorizationCVE-2023-52177 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.3.
Product
Integrate Google Drive
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024ProfileGrid: Missing AuthorizationCVE-2023-52117 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid: from n/a through 5.6.6.
Product
ProfileGrid
Affected
up to 5.6.6
What to do
Affects up to 5.6.6. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Quotes for WooCommerce: Missing AuthorizationCVE-2023-51680 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in TechnoVama Quotes for WooCommerce.This issue affects Quotes for WooCommerce: from n/a through 2.0.1.
Product
Quotes for WooCommerce
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Quotes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024BulkGate SMS Plugin for WooCommerce: Missing AuthorizationCVE-2023-51679 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BulkGate BulkGate SMS Plugin for WooCommerce.This issue affects BulkGate SMS Plugin for WooCommerce: from n/a through 3.0.2.
Product
BulkGate SMS Plugin for WooCommerce
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update BulkGate SMS Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024FunnelKit Checkout: Missing AuthorizationCVE-2023-51671 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.
Product
FunnelKit Checkout
Affected
up to 3.10.3
What to do
Affects up to 3.10.3. Update FunnelKit Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024FunnelKit Checkout: Missing AuthorizationCVE-2023-51670 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.
Product
FunnelKit Checkout
Affected
up to 3.10.3
What to do
Affects up to 3.10.3. Update FunnelKit Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Awesome Support: Missing AuthorizationCVE-2023-51537 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.5.
Product
Awesome Support
Affected
up to 6.1.5
What to do
Affects up to 6.1.5. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.